jaffacakes118_Trojan[.]NSIS[.]Inject[.]epm[.]86468936ed74a662cf8e802c4d5a1246

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.NSIS.Inject.epm.86468936ed74a662cf8e802c4d5a1246
Size 345KB
Sample261006-vtfavsff96
SHA256 b6b52df23b7ea50254b56f6fa55026aeb8f3b204b8639f04c7c9d1c1a21bc1ab
MD5 86468936ed74a662cf8e802c4d5a1246
SHA1 90f87c725ebf1d484fd4f11729a59464745cc1cb
SHA512 b83ad37fad685750977982f07e0f25f5121f137599f49333cd00733bd9c82fe523420a4112abf04a7d3d2c16ad2377551947af88a842b9a7f3ea2135cd04a7b8
SSDEEP 6144:9wHysGRTh0x0ktLK79XpGsy0u/kT5rKhW4A124UGknip6l/8ecZYdTZ:mGReiUU6L0u/hY4K2d7nP/4ZwTZ
TLSH
T19674122117F558BFF9130A341E62F672F27E92056129159B4BE48F8E3D203825DEB29E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.NSIS.Inject.epm.86468936ed74a662cf8e802c4d5a1246
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/Ylevels.dll
unpack001/uninstall.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

File Explorer

jaffacakes118_Trojan.NSIS.Inject.epm.86468936ed74a662cf8e802c4d5a1246

.exe 345KB
$PLUGINSDIR/System.dll

.dll 11KB
$TEMP/Splanchnology

283KB
$TEMP/Ylevels.dll

.dll 52KB
uninstall.exe

.exe 34KB

jaffacakes118_Trojan.NSIS.Inject.epm.86468936ed74a662cf8e802c4d5a1246

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 b6b52df23b7ea50254b56f6fa55026aeb8f3b204b8639f04c7c9d1c1a21bc1ab
MD5 86468936ed74a662cf8e802c4d5a1246
SHA1 90f87c725ebf1d484fd4f11729a59464745cc1cb
SHA512 b83ad37fad685750977982f07e0f25f5121f137599f49333cd00733bd9c82fe523420a4112abf04a7d3d2c16ad2377551947af88a842b9a7f3ea2135cd04a7b8
SSDEEP 6144:9wHysGRTh0x0ktLK79XpGsy0u/kT5rKhW4A124UGknip6l/8ecZYdTZ:mGReiUU6L0u/hY4K2d7nP/4ZwTZ
TLSH
T19674122117F558BFF9130A341E62F672F27E92056129159B4BE48F8E3D203825DEB29E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
SSDEEP 192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
TLSH
T1BE324B19135442F3E5D5883D186A3ABB1F28762196E08F83DFB36881FF386D56D39312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10020

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Ylevels.dll

IMPHASH 39c06f3dc5d651e300b48e95da32f870
SHA256 369d95124d8041ff825f82415c822c193e8c840a7ce0e986b99a847fd36f2977
MD5 587e0c9c0a60d6ff07b3e1c8c10cbaf9
SHA1 f16e376f51d366ec49991dba1717fdff694dfecd
SHA512 973942c9b47380c00c08ed824963d514d638583242357b99e47893dee9a12ebaefe0fbf1504ee863195101b7fa78bafda4b4f1daef78cc1a8e1b8cd4d59cd7d2
SSDEEP 768:jBwRDBUB6mBOZdGN+fMWvZGeOvV/ROiB9iK0Is+QsT:g3nt5zI5hc+
TLSH
T140333C397382C563E0DA40B57058DB67997D3F30039144D3BBA12F5A3E39AE5A63AB07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

11439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

uninstall.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 2d9d85b77a5fa248b25583b01bfc24213bacbcec0d6c8466242cd11a5bebc290
MD5 27bb4f0df3d0bd275e914761093bcb66
SHA1 44a4f5ad3a9e1f1e9ce22acd31251ec3e9088d52
SHA512 ba1f597fe83dd0de3a8f23843e7855e5333d1cca72cff5403ea334a481577ee3a30f31785c266e321f294412b1c974b835e10a860b104b5935c3883f5e692fb3
SSDEEP 768:eWwSOHQVoQM8ios/aASUsWRs25iUk68v1fT3XJPdEZgJRnt7Wy:9wJOoN1oYaoZ5iV685XJPCZw7Wy
TLSH
T1CDF27E1236F084BBE59745710FB7AB7AF776E7002425464F6B60AFA92C31243D90A1CE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

jaffacakes118_Trojan.NSIS.Inject.epm.86468936ed74a662cf8e802c4d5a1246

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/Splanchnology

$TEMP/Ylevels.dll

advapi32

gdi32

kernel32

generic

uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic